I have been looking to set this up for our network also.  I have been waiting to Cisco Nat2 to come out first.  The issue on the AV is pretty normal, I get to set the acceptable standards that I have deemed good, some may not agree with your standards but it is my network.  I can not go out and search all dat files for every AV company so I pick the ones I have agreed to keep to the standard.  Now the issue that the client has to be installed is pretty normal but I have not seen the problem you are saying.  Have you added the school domain to the trusted sites?  This might allow the install of this client you are talking about.  At a minium you should be able to go to a non secure area like just internet not any of the school domain.